feat(nh3-svos): VM 111 on nh3-pve-2 for the new SVOS (svos-dev, Prime); generic cloud-init VM playbook

2026-10-05 18:59:53 -07:00
parent 2c4c7ca9ae
commit d7e845eb64
9 changed files with 291 additions and 0 deletions
@@ -0,0 +1,40 @@
+# nh3-svos: host for the NEW SVOS operating system (VM 111 on nh3-pve-2, NH3)
+
+Built 2026-10-05 at svos-dev's request, relaying Prime ("stand up a dedicated VM for it on nh3-pve-2"). It runs the
+new SVOS (repo `corviduo/svoperatingsystem`): a FastAPI/uvicorn kernel (SQLite WAL, synchronous FULL, one writer),
+an interface connector, an optional voice adapter and a static phone/desktop UI.
+**It is a separate instance.** The existing High Seat (`svos.service` on nh3-dev, `:8770`) and Miranda are NOT
+migrated by this host.
+
+**Ownership split:** infra-ops owns the VM, OS, access, backups and ingress. svos-dev owns the application: install,
+configuration, enrollment and acceptance.
+
+| | |
+|---|---|
+| Address | `10.100.50.43`, VLAN 50 (nh3-servers), static via cloud-init; `nh3-svos.nh3.internal` |
+| Guest | VM **111** on **nh3-pve-2**, `onboot 1`, tag `svos` |
+| Shape | 4 vCPU `x86-64-v3`, 8 GiB, 100 GB on `vmstore` (local NVMe LVM-thin, discard on). nh3-pve-2 had 47 GB RAM and 946 GB vmstore free at build |
+| OS | Debian 13 genericcloud, Python 3.13 + venv, SQLite 3.46, systemd-timesyncd (synced), qemu-guest-agent |
+| Identities | `vh` 1000 (operator keys + lkraven@nh3-dev, so svos-dev's session can ssh in; NOPASSWD sudo from cloud-init), `infra-ops` 850, **`svc-svos` 801** (nologin; the only writer of the data root) |
+| Data root | `/var/lib/svos`, svc-svos 0700, on the local root ext4. Never NFS, never shared |
+| Releases | `/opt/svos` root:svc-svos 2775, with `releases/` for svos-dev's layout. The git checkout is not a runtime dependency |
+| Docker | none, by design |
+| Backups | nh3-pve-2 vzdump job, nightly **21:30**, `all 1` → pbs-ana namespace `nh3-pve-2` (mirrored to pbs-nh3 at 06:30), snapshot mode with guest-agent fs-freeze |
+| App-consistent hook | `/etc/qemu/fsfreeze-hook.d/` exists. The guest agent runs those scripts on vzdump's freeze/thaw, which is where svos-dev's SQLite checkpoint hook belongs. Until it lands, backups are crash-consistent (fine for WAL + synchronous FULL, but not the stated requirement) |
+| Monitoring | not yet. Beszel needs the native agent here (no Docker); that is pending together with nh3-albok's |
+
+## Build (reproducible)
+
+```bash
+scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-cloudinit-vm.yaml --var vmid=111 \
+  --var name=nh3-svos --var ip=10.100.50.43/24 --var cores=4 --var memory=8192 --var disk=100G --var tags=svos \
+  --var "description=..."
+scripts/elway vh@10.100.50.43        --playbook playbooks/bootstrap-infra-ops-user.yaml
+scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml
+```
+
+## Ingress / auth: NOT built yet, proposal pending (Prime + svos-dev)
+
+App listeners stay private (loopback or a Unix socket). The front door has to give the browser **HTTPS**: the UI and the
+voice adapter need a secure context for the microphone. It also has to give the kernel's adapter a **verified identity**
+in `Tailscale-User-Login`, with any browser-supplied copy stripped. See the svos-dev thread of 2026-10-05.
@@ -0,0 +1 @@
+infra-ops@10.100.50.43
@@ -0,0 +1,77 @@
+
+===== HOST =====
+
+Hostname:   nh3-svos.nh3.internal
+Date:       2026-10-05T18:59:30-07:00
+Uptime:     up 1 minute
+OS:         Debian GNU/Linux 13 (trixie)
+Kernel:     6.12.111+deb13-cloud-amd64
+Arch:       x86_64
+
+===== HARDWARE =====
+
+CPU cores:  4
+CPU model:  QEMU Virtual CPU version 2.5+
+MemTotal:   7.8 GB
+MemAvailable: 7.4 GB
+
+===== GPUS =====
+
+nvidia-smi not present (no NVIDIA GPUs or driver not installed)
+
+===== FILESYSTEMS (df) =====
+
+Filesystem      Size  Used Avail Use% Mounted on
+/dev/sda1        99G  862M   94G   1% /
+/dev/sda15      124M  8.9M  115M   8% /boot/efi
+
+===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====
+
+PARTUUID=fd202e72-0241-4c3b-953d-ffe506ae6cfc / ext4 rw,discard,errors=remount-ro,x-systemd.growfs 0 1
+PARTUUID=b558256e-e822-4787-9bd2-c4c47dfb54d9 /boot/efi vfat defaults,umask=077 0 2
+
+===== TARGETED DATA PATHS =====
+
+/opt  (total: 12K)
+  total 12
+  drwxr-xr-x  3 root root     4096 2026-10-05 18:58 .
+  drwxr-xr-x 18 root root     4096 2026-10-05 18:58 ..
+  drwxrwsr-x  3 root svc-svos 4096 2026-10-05 18:58 svos
+
+/srv  (total: 4.0K)
+  total 8
+  drwxr-xr-x  2 root root 4096 2026-09-30 21:57 .
+  drwxr-xr-x 18 root root 4096 2026-10-05 18:58 ..
+
+
+===== DOCKER =====
+
+docker not installed
+
+===== COMPOSE FILES (/opt/docker/compose/) =====
+
+/opt/docker/compose not present
+
+===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====
+
+/opt/docker/conf not present
+
+===== LISTENING PORTS =====
+
+0.0.0.0:22
+0.0.0.0:5355
+127.0.0.53%lo:53
+127.0.0.54:53
+[::]:22
+[::]:5355
+
+===== MODEL / HUGGINGFACE CACHES =====
+
+
+===== DOCKER-ADJACENT SYSTEMD SERVICES =====
+
+(none matching)
+
+===== DONE =====
+
+Paste the above back into the chat, or pass a path as argv[1] to save.